Adobe Flash Player and AIR Cross-Domain Information Disclosure Vulnerability (CNVD-2015-04573)

Adobe Flash Player is an integrated multimedia player. Adobe AIR is a technology developed for the integration of web and desktop applications, allowing control of cloud-based programs on the web without having to go through a browser. Adobe Flash Player and AIR have cross-domain information...

Adobe Flash Player and AIR Cross-Domain Information Disclosure Vulnerability (CNVD-2015-04565)

Adobe Flash Player is a player that parses SWF content. Adobe AIR is a technology developed for the integration of web and desktop applications, which allows you to control cloud-based programs on the web without having to go through a browser. Adobe Flash Player and AIR have implementation...

Adobe Flash Player and AIR Cross Domain Information Disclosure Vulnerability

Adobe Flash Player is a player that parses SWF content. Adobe AIR is a technology developed for the integration of web and desktop applications, which allows you to control cloud-based programs on the web without having to go through a browser. Adobe Flash Player and AIR have an implementation...

http-cross-domain-policy NSE Script

Checks the cross-domain policy file /crossdomain.xml and the client-acces-policy file /clientaccesspolicy.xml in web applications and lists the trusted domains. Overly permissive settings enable Cross Site Request Forgery attacks and may allow attackers to access sensitive data. This script is...

Internet Bug Bounty: Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079)

Some of the sandbox logic of Flash Player can be circumvented on most web browsers by using special URL schemes. A website can deploy an SWF file via the data: or blob: URL schemes perhaps others. An app started in this way runs in the "local with files" or "local with networking" sandbox,...

Adobe AIR for Mac <= 17.0.0.124 Multiple Vulnerabilities (APSB15-05)

According to its version, the installation of Adobe AIR on the remote Mac OS X host is equal or prior to 17.0.0.124. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption flaws exist due to improper validation of user-supplied input. An attacker can exploit these...

Adobe Flash Player Cross Domain Policy Bypass (APSB15-11: CVE-2015-3099)

Adobe Flash Player is vulnerable to a cross domain policy bypass. If the victim opens a maliciously crafted file using certain URL, the file could cause a privilege escalation and allow unlimited cross-domain access...

Unity Web Player Zero-Day Vulnerability Disclosed

Some detail has been disclosed about a zero-day vulnerability in the Unity Web Player browser plugin that can allow an attacker to use a victim’s credentials to read messages or otherwise abuse their access to online services. The partial disclosure was made after nearly six months of bug-report...

Adobe Flash Player Domain Policy Bypass (APSB15-10: CVE-2015-3079)

Adobe Flash Player is vulnerable to a cross domain policy bypass. If the victim opens a maliciously crafted file using certain URL schemes, the file could cause a privilege escalation and allow unlimited cross-domain access...

Safari browser cookie access vulnerability affects billions of Apple products-vulnerability warning-the black bar safety net

Present in the Safari browser in a cookie access Vulnerability, CVE-2 0 1 5-1 1 2 6 may affect billions of Apple products, if you are using Safari, be sure to as soon as possible to detect whether it is affected by the vulnerability, if affected Please as soon as possible repair. FreeBuf science:...

Safari iOS/OS X/Windows cookie access vulnerability

OVERVIEW ========== The 4/8/2015 security updates from Apple included a patch for a Safari cross-domain vulnerability. An attacker could create web content which, when viewed by a target user, bypasses some of the normal cross-domain restrictions to access or modify HTTP cookies belonging to any...

Apple Fixes Cookie Access Vulnerability in Safari on Billions of Devices

When Apple pushed out its most recent round of patches last week it fixed a cookie vulnerability that existed in all versions of Safari, including those that run on iOS, OS X, and Windows. According to researchers who dug it up, the number of affected devices may total one billion. The issue –...

Safari Cross-Domain Hijacking

OVERVIEW ========== The 4/8/2015 security updates from Apple included a patch for a Safari cross-domain vulnerability. An attacker could create web content which, when viewed by a target user, bypasses some of the normal cross-domain restrictions to access or modify HTTP cookies belonging to any...

Apple Mac OS X Cross-Domain HTTP Request Header Authentication Credentials Disclosure Vulnerability

Apple Mac OS X is an operating system developed by Apple Inc. A cross-domain HTTP request header validation credential disclosure vulnerability exists in Apple Mac OS X CFNetwork Session Handling Redirection, which allows attackers to exploit the vulnerability to obtain sensitive information...

Apple Mac OS X/iOS CFNetwork HTTPProtocol Cross Domain COOKIE Disclosure Vulnerability

Apple Mac OS X is an operating system developed by Apple Inc. Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A cross-domain COOKIE disclosure vulnerability in the Apple Mac OS X/iOS CFNetwork HTTPProtocol handling redirection allows attackers to explo...

Flash Player < 16.0.0.306 (inferred) Multiple Vulnerabilities (APSB15-01 through 05)

Binary data 8655.prm...

Adobe Flash Player Cross Domain Policy Bypass (APSB15-05: CVE-2015-0340)

Adobe Flash Player is vulnerable to a cross domain policy bypass. If a maliciously crafted file is opened on the target computer, it could initiate a file upload without a user initiated action and to another domain without verifying the cross domain policy...

EMC M&R (Watch4net) - Credential Disclosure Vulnerability

It was discovered that EMC M&R Watch4net credentials of remote servers stored in Watch4net are encrypted using a fixed hard-coded password. If an attacker manages to obtain a copy of the encrypted credentials, it is trivial to decrypt them. Abstract It was discovered that EMC M&R Watch4net...

RHEL 5 / 6 : flash-plugin (RHSA-2015:0697)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0697 advisory. - flash-plugin: multiple code execution issues fixed in APSB15-05 CVE-2015-0332, CVE-2015-0333, CVE-2015-0334, CVE-2015-0335,...

flash-plugin: cross-domain policy bypass (APSB15-05)

Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass the Same Origin Policy via unspecified vectors...